JP6320501B2 - Establishing a device-to-device communication session - Google Patents

Description

  The present invention relates to a method for establishing a device-to-device (D2D) communication session between mobile devices. The invention also relates to a mobile device for establishing a D2D communication session with a further mobile device. The present invention further relates to control software including instructions for execution on a mobile device. The invention additionally relates to a mobile network.

Mobile communication networks, also referred to as cellular networks or mobile networks, have been extensively deployed over the last decades to address the growing need for mobile communications. Communication between mobile devices is connected to such a mobile network and typically takes place via the mobile network, ie through one or more base stations and core nodes of the mobile network.
It would be desirable to be able to communicate directly with each other, i.e., so-called device-to-device (D2D) communication, with mobile devices typically connected to a mobile network.

  D2D communication is a direct wireless connection between mobile terminals, such as two mobile devices, at least at some point, with or at least maintaining a signaling connection with / through the base station of the mobile network. Characterized by communication path. A direct wireless communication path between mobile terminals allows the wireless communication network base station (s), access network and core network to be offloaded from most of the data and signaling exchanged between the mobile terminals To. The signaling connection with the wireless communication network (its base station) allows the wireless communication network to control the resources allocated to the direct communication path between the terminals.

  As an alternative to communicating over a mobile network, mobile devices that use D2D communication at a given time relate to operation in direct mode operation (DMO). DMO offers advantages such as allowing mobile communications between users outside the range of the mobile network, for example, and reducing loads such as from the base station and / or from the core node of the mobile network.

  Terrestrial Trunked Radio (TETRA) is an example of a mobile communication standard that enables mobile communication between mobile devices via a mobile network and the D2D communication described above.

  Another example of such a mobile communication standard is the Global System for Mobile Communications (GSM). The GSM standard includes so-called local call local switch features, where mobile communications between mobile devices connected to the same base station of the mobile network are routed through the core node of the mobile network. Rather than being routed, it is routed directly from the base station to each mobile device.

  Yet another example is Long Term Evolution (LTE). Recent deployments of LTE include D2D communication between mobile devices. Note that an LTE context such as D2D communication is also directly referred to as LTE.

The above mobile network and mobile device challenge is that mobile network operators do not have control over D2D communication or have limited control. The inventor has recognized that such control is desirable for various reasons. For example, D2D communication can be implemented in a frequency spectrum that is licensed to an operator, that is, the operator needs to operate to avoid interference. In another example, an operator may only want to grant a particular user access to D2D communications. For example, an emergency worker or a D2D subscriber.
It would be advantageous to provide more control through D2D communication between mobile devices connectable to a mobile network.

To better address this concern, a first aspect of the invention provides a method for establishing a D2D communication session for a mobile device. Mobile devices can be connected to each other via a D2D communication channel and can be individually connected to a mobile network. The method includes the following steps. That is,
-Preloading each mobile device with a start key, wherein the start key is associated with a validity period, and at each mobile device:
-Verifying the validity of the start key based on the current time;
The step of generating a session key using a start key by using the start key when performing a key agreement procedure between mobile devices over a D2D communication channel when the start key is considered valid; A session key if the start key used by each mobile device matches as a result of the key agreement procedure, and
-Establishing a D2D communication session over the D2D communication channel based on the session key.

  Another aspect of the present invention is control software comprising instructions that, when executed on a mobile device, cause the mobile device to establish a D2D communication session according to the method described above.

Another aspect of the present invention is a mobile device for establishing a D2D communication session with a further mobile device, the mobile device and the further mobile device via a D2D communication channel. They can be connected to each other and individually connected to the mobile network. The mobile device comprises: That is,
A storage area (SA1) for storing a start key provided during the preload procedure, wherein the start key is associated with a validity period, and a computing subsystem (CS1),
-Verify the validity of the start key based on the current time,
If a start key is considered valid, generate a session key using the start key by using the start key when performing a key agreement procedure with a further mobile device through the D2D communication channel, If the result of the agreement procedure is that the start key used by the mobile device and the further mobile device matches, the computing subsystem to be the session key, and D2D through the D2D communication channel based on the session key A mobile subsystem for establishing a communication session is provided.

  Another aspect of the invention provides a mobile network (MN) configured to preload a mobile device with a start key when the mobile device is connected to a mobile network, wherein the start key is Associated with a validity period.

  By the above means, a D2D communication session is established or provided between mobile devices that can be connected to each other via a D2D communication channel and can be individually connected to a mobile network. Here, the term communication channel refers to a conduit for the exchange of information between mobile devices, and the term communication session relates to the exchange of information, which is typically the beginning and end of the specification. Have

  A mobile device can be connected to a mobile network. When the mobile device is connected to the mobile network, mobile communication between the mobile devices can be performed via the mobile network, for example via the base station and the core node of the mobile network. The mobile device is also configured to establish a D2D communication channel between the mobile devices. Although D2D communication can be established between two mobile devices, D2D communication may involve three or more mobile devices equally.

  A D2D communication session is established or set up in the following manner. Initially, a start key is preloaded on each of the mobile devices. Here, the term preload relates to loading a start key on a mobile device before establishing a D2D communication session. For example, a start key can already be loaded into the mobile device before a request is received to establish a D2D communication session. The start key is used on each of the mobile devices when establishing a D2D communication session. Thus, when a request to establish a D2D communication session is received, eg, from a user or another mobile device, obtaining a start key is not necessarily required to establish a D2D communication session. That is, the D2D communication session is already available on the mobile device.

  The start key is used to establish a D2D communication session in the following manner. The start key is associated with the validity period. The validity period can be used by the mobile device by providing the next start key, being derived from the start key, and so on. The validity period indicates a period of time that is considered valid for using the start key when establishing a D2D communication session. The validity of the start key is verified based on the current time at each of the mobile devices that will participate in the D2D communication session. It will respond to a request to establish a D2D communication session. That is, the current time can be used to determine whether the start key is considered valid. For example, if the current time is in a valid period and the start key is considered valid, the start key is used to perform a key agreement procedure between mobile devices.

  Here, the key agreement procedure relates to a procedure executed between mobile devices. As a result of the key agreement procedure, a session key will be placed, and each mobile device can influence the outcome of the procedure, ie the session key. The key agreement procedure is performed using messages that together constitute the key agreement procedure, for example by exchanging messages between mobile devices via a D2D communication channel. Messages can be exchanged as part of an initial D2D communication session established via a D2D communication channel.

  The key agreement procedure provides a session key based on whether the start key used by each mobile device in the key agreement procedure matches. Thus, a valid session key is obtained when each mobile device uses the same start key in the key agreement procedure. The session key constitutes a key that is used for messages that are encrypted and protected in a communication session, such as security using encryption or integrity protection using a message authentication code. A D2D communication session is established using a session key. That is, a D2D communication session is acquired, where a message such as a voice or video transmission message between mobile devices is encrypted and protected using a session key. The session key is used for a specific D2D communication session. Thus, in order to establish a new communication session at a later time, it is usually necessary to obtain or generate a new session key.

  The above means has an effect that the D2D communication session is established based on the start key. Thus, the start key basically functions as an authentication token in that the mobile device needs the start key to establish a D2D communication session. By providing a start key associated with the validity period and verifying the validity of the start key of the mobile device based on the current time, a time-based control mechanism is provided, and the start key is only for a predetermined period of time. It is considered valid and invalid outside this period.

  The above means provide control to the operator via D2D communication in the following manner. By requesting a valid start key to establish a D2D communication session, the operator gains control and the operator can select which to provide the start key according to the conditions. Furthermore, the validity period means the operator can obtain time-based control, for example, thereby preventing reuse of the old start key. By using the start key in a key agreement procedure based on a match of the start key used by the mobile device, the operator gains control and any start key can be used to establish a D2D communication session. Rather, the success of the key agreement procedure depends on whether the start key used by each mobile device in establishing the D2D communication session matches.

  Advantageously, by preloading the start key, the D2D communication session can be out of the mobile network, for example, when one or more mobile devices are currently out of direct operator control. Even can be established under operator control. Advantageously, the mobile device can establish a D2D communication session independently, ie without having to contact a third party.

  Optionally, preloading the start key includes providing the start key to each mobile device via the mobile network when each mobile device is connected to the mobile network. Preloading the start key over the mobile network can be convenient. This is because mobile devices are frequently connected to the mobile network, that is, no additional means are required to preload the start key. Advantageously, the mobile network provides a secure channel for preloading the start key. Advantageously, the start key can be automatically preloaded, i.e. without requiring user action.

  Optionally, preloading the start key includes storing the start key in a secure storage area at each mobile device. In other words, the start key is stored so that it cannot be easily read by, for example, a user, that is, an application running on the mobile device. Advantageously, tampering with the start key can be made more difficult.

  Optionally, the secure storage area is provided by a reliable computing subsystem in each mobile device. Here, the mobile device comprises a reliable computing subsystem, either as an integrated part or as a removable part. Such a reliable computing subsystem can be used to perform computational steps on a mobile device. The calculation step requires a specific security level to authenticate the mobile device in the mobile network. An example of a removable reliable computing subsystem is the so-called Universal Integrated Circuit Card (UICC). The UICC comprises a Universal Subscriber Identity Module (USIM) that is used to authenticate mobile devices in a mobile network. The secure storage area is provided by the memory of such a reliable computing subsystem, eg UICC, and is well suited for securely storing the start key on the mobile device.

  Optionally, at least one of the group consisting of verifying the validity of the start key and using the start key in performing the key agreement procedure is performed by the trusted computing subsystem. The Thus, the use of a start key outside the secure storage area provided by the trusted computing subsystem is reduced or avoided. Advantageously, alteration of the start key becomes more difficult.

Optionally, the method further comprises
-Preloading each mobile device with a set of start keys, wherein a set of start keys is associated with each of a set of validity periods; and-a set of start keys at each mobile device. Performing a key synchronization procedure between the mobile devices through the D2D communication channel to select one of the matching ones as a start key.

  Thus, each mobile device is provided with a plurality of different start keys. A key synchronization procedure is performed to allow the same start key to be used by each of the mobile devices in establishing a D2D communication session. Here, which start key is identified as being usable for all or most of the mobile device. The start key is selected to be used to establish a D2D communication session. Advantageously, a suitable start key can be established accordingly. Advantageously, the key synchronization procedure provides feedback if the mobile device does not have a proper starting key before performing the key agreement procedure.

Optionally, the method further comprises
-Preloading each mobile device with a set of key identifiers, each of the set of key identifiers identifying a respective one of the set of starting keys; and-between the mobile devices Performing a key synchronization procedure based on the exchange of one or more of the set of key identifiers.

  Engaging the start key itself in the key synchronization procedure by performing the key synchronization procedure based on an exchange of one or more of a set of key identifiers, for example by exchanging the start key through a D2D communication channel I don't need it. Advantageously, alteration of the start key becomes more difficult. This is because only the key identifier is exchanged. Nevertheless, falsification of the key identifier, for example, pretending to match the start key will still fail. This is because the key agreement procedure only provides a session key if the actual start key matches.

  Optionally, the method also includes revoking or removing the start key from the set of start keys after being used in establishing the D2D communication session. That is, the start key cannot be used unless a D2D communication session is once established. In order to establish a new D2D communication session, a new start key is required. Advantageously, the operator obtains control over the number of times, for example to limit the number of times that a D2D communication session can be established.

  Optionally, the set of valid periods is constituted by at least part of different but overlapping valid periods. Different but valid lifetimes together constitute a larger time period. Since the validity periods overlap, there is no gap in the larger time period. Different but overlapping validity periods are associated with the start key. As a result, the start key can be used at any point in time for a larger period of time and can be useful for use in establishing a D2D communication session.

  Optionally, a start key is associated with the virtual network identity. Verifying the validity of the start key further includes determining a match of the virtual network identity of each mobile device via the D2D communication channel. That is, a D2D communication session can only be established between mobile devices having the same virtual network identity. Advantageously, the operator can set up a virtual network between mobile devices capable of D2D communication, but belongs to a D2D communication with a mobile device outside the virtual network, or to a different virtual network Prevent D2D communication between mobile devices.

  Optionally, a start key is associated with the usage count to limit the number of uses of the start key, and the step of verifying the validity of the start key is further based on the usage count. Advantageously, the operator obtains control over the number of times that a D2D communication session can be established. Advantageously, the control can be provided with a start key, for example a master key, that can be used to establish multiple D2D communication sessions. That is, there is no need to provide a set of start keys, each of which can only be used once to establish a D2D communication session.

  Optionally, the method further includes adjusting the usage count after using the start key in establishing the D2D communication session. Therefore, the use of the start key when establishing a D2D communication session is reflected in the usage count.

  Optionally, the method further includes: i) no start key is considered valid, or ii) a further start key via the mobile network if the key agreement procedure fails to provide the session key. Requesting.

Optionally, the key agreement procedure is
-Three-pass authentication procedure (166), or-Use of initiation key to encrypt message exchange between mobile devices to obtain a shared secret (164) and initiated based on the shared secret Includes Diffie-Hellman key exchange procedure.

  For those skilled in the art corresponding to the modifications and variations described for the method, modifications and variations for control software, mobile devices, and mobile networks can be implemented based on the present description.

  The invention is defined in the independent claims, and any further advantageous embodiments are defined in the dependent claims. These and other aspects of the invention are apparent from and will be elucidated with reference to the embodiments described hereinafter.

FIG. 1 shows a mobile device that can be connected to each other via a D2D communication channel and can be individually connected to a mobile network. FIG. 2 illustrates a method for establishing a D2D communication session between mobile devices. FIG. 3 illustrates a mobile device that includes a computing subsystem including a mobile subsystem and a storage area. FIG. 4 illustrates the determination of each mobile device's virtual network identity match over the D2D communication channel. FIG. 5 illustrates the execution of a key synchronization procedure between mobile devices over a D2D communication channel. FIG. 6 illustrates a key agreement procedure that is initialized over a D2D communication channel by using a start key to encrypt a message exchange between mobile devices to obtain a shared secret. FIG. 7 illustrates a key agreement procedure performed through a D2D communication channel based on a three-pass authentication procedure. FIG. 8 illustrates a key agreement procedure performed over a D2D communication channel in which an identifier identifying a mobile device is encrypted.

  It should be noted that items having the same reference numerals in different drawings have the same structural features and the same function, or are the same signal. Although the function and / or structure of such items has been described, these descriptions in the detailed description of the invention need not necessarily be repeated.

  FIG. 1 shows a first mobile device MD1 and a second mobile device MD2. In the future, it may be collectively referred to as mobile device MD. The mobile device MD can be individually connected to the mobile network MN. As shown in FIG. 1, a communication channel exists between each mobile device MD and the mobile network. That is, the device-to-network communication channel DNC. The mobile network MN is illustrated as including base stations BS1, BS2. In particular in this example, each mobile device MD is connected to a different one of the base stations BS1, BS2. Base stations BS1 and BS2 are connected to each other via a core node CN of the mobile network. In this way, when the mobile device MD is connected to the mobile network MN, communication between the mobile devices can be performed via the mobile network MN, and the exchange of information is performed at the base point in the mobile network. It can be performed through a first one of the stations BS1, a core node CN, and a second one of the base stations BS2.

  The mobile devices MD are also connectable to each other via the D2D communication channel DDC. The D2D communication channel DDC is established, i.e. set up, using the mobile subsystems MS1, MS2 which the mobile devices MD1, MD2 respectively have. The invention relates to establishing a D2D communication session between the mobile devices MD via the D2D communication channel DDC.

  A D2D communication session may be established according to the method 100 shown in FIG. The method 100 initially includes a step 120 of preloading a start key to each of the mobile devices MD. The preloading step 120 can be performed using the mobile network MN. For this purpose, the mobile network MN provides a start key to the mobile device MD via the device-to-network communication channel DNC when one of the mobile devices MD connects to the mobile network MN. It can be constituted as follows. However, the preloading step 120 may also require another communication channel, in particular a secure communication channel. For example, the start key may be used, for example, using near field communication (NFC) at a physical point of sale or using, for example, WiFi over a wireless local area network (WLAN). May be preloaded.

  Although not shown in FIG. 1, each mobile device MD may include a storage area for storing a start key in each mobile device MD. Therefore, the step 120 of preloading the start key to each mobile device MD includes storing the start key in the storage area of each mobile device MD.

  The start key is associated with the validity period. The method 100 further includes a step 140 of verifying the validity of the start key for each mobile device MD based on the current time. As such, each mobile device MD1, MD2 includes a computing subsystem CS1, CS2, and is configured to perform the above steps, and has knowledge about or obtains the current time. Can be configured. It should be noted that the validity period can be expressed in any time-based amount, such as one day, one hour within a day, one minute within one hour, or the like. Thus, the term current time can relate to the current date and / or the current date and time, for example. Thus, the step of validating the validity of the start key includes determining whether the current day is within the validity period, in which case the current day is either the first day or the last day of the validity period And in that case, the current date and time is within the validity period.

  The method further includes using a start key when performing a key agreement procedure between the mobile devices MD through the D2D communication channel DDC, if the start key is considered valid at each mobile device MD. Generating a session key 160 using the start key. The computing subsystems CS1, CS2 of each mobile device MD is configured to perform the above steps while the mobile subsystems MS1, MS2 perform the actual message exchange through the D2D communication channel DDC.

  The key agreement procedure is configured to result in a session key if the start key used by each mobile device MD matches. Upon obtaining the session key, the method 100 includes establishing 180 a D2D communication session over the D2D communication channel DDC based on the session key at each mobile device MD. The mobile subsystems MS1, MS2 of each mobile device are configured to perform the above steps using the session key obtained from the computing subsystems CS1, CS2.

  Although not shown in FIG. 2, when the control software is executed on the mobile device, the mobile device is validated according to the method 100 shown in FIG. 2, ie, based on the current time, for the validity of the start key. Control software including instructions for establishing a D2D communication session by step 140, generating a session key using a start key 160, and establishing a D2D communication session through a D2D communication channel based on the session key 180 Can be provided.

  FIG. 3 shows a first mobile device MD1. The first mobile device here is an example of each mobile device MD. The first mobile device MD1 includes the mobile subsystem MD1 and the computing subsystem CS1 introduced above with reference to FIGS. Here, the term mobile subsystem refers to the main functions of a mobile device, including establishing a communication channel, exchanging messages over the established communication channel, performing various calculation functions, etc. It relates to a subsystem of a mobile device that enables and / or enables. An example of a mobile subsystem is an application processor, a display processor, one or more modems, and a mobile system on chip (SoC) that includes an integrated LTE radio. Another example is the mobile SoC and an external LTE radio connected to the SoC.

  FIG. 3 shows a first mobile device MD1 comprising a storage area SA1 for storing the start key provided during the preload procedure. The storage area SA1 can be a secure storage area. In the example of FIG. 3, the storage area SA1 is provided by the computing subsystem CS1. The computing subsystem CS1 can be a reliable computing subsystem, which automatically provides a secure storage area. Such a reliable computing subsystem CD1 can be configured by a UICC including a USIM application. The USIM application may be configured to establish a D2D communication session according to the method 100 shown in FIG. The interface to the UICC can be protected, for example, by means of a secure channel protocol using ETSITS 102 484 technology, which can make eavesdropping and tampering more difficult.

  Two embodiments of the present invention are presented below. Each comprises further advantageous optional means. It will be appreciated that these means can also be combined and / or individually applied to the generic concept of the present invention if not impeded by technical suitability.

  The first detailed embodiment includes preloading a set of start keys at each mobile device MD. A set of start keys is associated with each of the set of validity periods. To that end, the mobile network MN can send one or more messages to the subsystems CS1, CS2 of each mobile device MD1, MD2 through each mobile subsystem MS1, MS2. The one or more messages can include a set of start keys and a set of validity periods. The one or more messages can also include a current network time and / or a set of limits. In addition to a set of start keys and a set of lifetimes, the one or more messages can include a set of key identifiers, each set of key identifiers including a respective one of the set of start keys. Identify. In addition to the set of start keys and the set of validity periods, the one or more messages include a set of virtual network identities. Each of the set of virtual network identities is associated with a respective one of the set of start keys.

The following table shows an example of information that can be preloaded on a mobile device.

  In general, in the case of the above example, a set of validity periods can be constituted by overlapping validity periods that are at least partially different. Each computing subsystem CS1, CS2 can store a set of start keys, a set of key identifiers, and the current network time in the secure storage area SA1 of the computing subsystem. Each computing subsystem CS1, CS2 can also dispose of any start key that has expired and has already been stored according to the current network time. A set of virtual network identities can be stored elsewhere in each mobile device MD1, MD2, ie, need not be stored in computing subsystems CS1, CS2.

  As part of establishing a D2D communication session through the D2D communication channel DDC, it can be determined whether the virtual network identities of each mobile device MD match. This allows a D2D communication session to be established between mobile devices MD that share a virtual network identity, whereas a mobile device ID where the D2D communication session does not share a virtual network identity. To be established between. For example, a corporate mobile device may include the corporate virtual network identity as well as the virtual network identity of the operator's own virtual network. The latter may allow the user to establish a D2D communication session with other users in the operator's mobile network. In general, a virtual network identity can be provided to, for example, a specific location, a specific group of users, a company, a family, and the like. A virtual network identity is also provided to allow a D2D communication session to be established between operators, i.e. between mobile devices typically belonging to a mobile network operated between different operators.

  FIG. 4 is an example 142 of how a virtual network identity match for each mobile device MD can be determined via the D2D communication channel DDC. Here, the computing subsystem CS1 and mobile subsystem MS1 of the first mobile device MD1 are shown on the left hand side, and the computing subsystem CS2 and mobile subsystem MS2 of the second mobile device MD2 are shown. Is shown on the right hand side. Furthermore, the message exchange between the mobile devices MD1, MD2 over the D2D communication channel DDC is schematically indicated by arrows over time. Arrows indicate the source and destination of the message. In addition, using a rectangle with rounded corners, the steps performed by either the mobile device MD1, MD2 are shown, and the horizontal arrangement of the rectangles indicates in which subsystem the steps are performed.

  The virtual network identity match can be determined as follows. First, the first mobile device MD1 sends a message to the second mobile device MD2 through the D2D communication channel. The message includes many or all of the virtual network identities stored on the first mobile device MD1. In response, in a step referred to as DET_OVERLAP_STEP, the second mobile device is which of the virtual network identities of the first mobile device MD1 is stored locally, i.e. at the second mobile device. Judge whether it matches. Further, in a step called ORDER_STEP, the duplicate virtual network identities are ordered according to the priority list of the second mobile device MD2, and the result is the first mobile Sent to the device MD1. Upon receipt, in a step referred to as SELECT_STEP, the duplicate virtual network identities are also ranked according to the priority list of the first mobile device MD1, and are most likely when combining both priority lists. A duplicate virtual network identity that is ranked higher is selected. Finally, the selected virtual network identity is sent by message to the second mobile device MD2, and then acknowledges the selected virtual network identity by returning a message.

  The step of verifying the validity of the start key includes the determination described above for the virtual network identity match of each mobile device via the D2D communication channel. As a result, if no match is found in the virtual network identity, the start key of both mobile devices is considered invalid for the purpose of establishing a D2D communication session between the mobile devices MD. This is because the key is associated with a non-matching virtual network identity.

  Once the virtual network identity match is verified, the establishment of the D2D communication session continues as follows. Each mobile device MD1, MD2 performs a key synchronization procedure between the mobile devices over the D2D communication channel to select a matched one of the set of start keys for each mobile device as the start key. Can be configured. FIG. 5 shows an example 162 of such a key synchronization procedure. This particular illustration is based on exchanging one or more of a set of key identifiers between the mobile devices MD1, MD2. Here, in response to a request from the mobile subsystem MS1, the computing subsystem CS1 retrieves a key identifier associated with a valid start key. A valid start key means that the start key was valid at the current time and was not used before establishing a D2D communication session. The computing subsystem CS1 can retrieve the key identifier based on various criteria such as, for example, whether the key identifier is valid at the current time and in a future reasonable period (eg, 15 minutes). . The search may also be based on the number of key sequences associated with each key identifier, and computing subsystem CS1 selects one of the key identifiers associated with the minimum number of key sequences. When the key identifier is represented as a number, the computing subsystem CS1 may also select the smallest one of the key identifiers. When the key identifiers are ranked sequentially, the computing subsystem may also select the first or last one of the key identifiers. It will be appreciated that various criteria as described above may be combined.

  The computing subsystem CS1 sends the found key identifier KeyID to the mobile subsystem MS1, which in turn sends it to the second mobile device MD2. In the second mobile device MD2, the mobile subsystem MS2 transfers the key identifier KeyID to the computing subsystem CS2. Furthermore, the second mobile device MD2 also performs the same process in parallel or after receiving the key identifier KeyID from the first mobile device MD1. As a result, the computing subsystems CS1, CS2 of each mobile device MD1, MD2 both have a key identifier. Each computing device CS1, CS2 then selects the largest key identifier in a step called MAX_KEYID_STEP. Thereby, the start key identified by the key identifier is also selected.

  Note that, in general, the start key can be invalidated or deleted after being used to establish a D2D communication session. However, in this case, a specific type of key synchronization procedure, such as the example shown in FIG. 3, leads to rapid consumption of the start key. Alternatively, the first mobile device MD1 may send the key identifier to the second mobile device MD2. The second mobile device MD2 requests from its computing subsystem CS2 to determine whether it contains a valid start key associated with this identifier. In that case, the start key can be selected directly. Otherwise, the computing subsystem CS2 can retrieve the smallest key identifier associated with a valid starting key and send the found key identifier to the mobile sub-device MD1 to send it to the first mobile device MD1. Return to system MS2. Upon receipt, the first mobile device MD1 requests its computing subsystem CS1 to determine if it has a valid start key associated with this key identifier. In that case, the start key can be selected directly. Otherwise, the computing subsystem CS1 retrieves the minimum key identifier and repeats the above process again.

  Note that the alternative key synchronization procedure can be repeated several times. Alternatively, the key synchronization procedure may be based on the exchange of many or all identifiers available for each mobile device, resulting in faster determination of key identifiers that identify matching and valid starting keys can do.

  It is further noted that the key exchange procedure can be combined with the authentication procedure. The authentication procedure can be a prerequisite part for setting up a D2D communication session. As a result, messages exchanged between multiple mobile devices can be served for both authentication and key exchange purposes. 7 and 8 show this example. For example, a message can constitute a challenge response from one mobile device, while the same time is part of a key exchange procedure between mobile devices.

  When a set of start key matches at each mobile device is selected as the start key, the establishment of the D2D communication session performs a key agreement procedure between the mobile devices through the D2D communication channel using the start key. Can continue. FIG. 6 is an example 164 of a first part of such a key agreement procedure that uses a start key to encrypt message exchanges between multiple mobile devices to obtain a shared secret. it can. The first part of the key agreement procedure can be used to initialize the key exchange procedure based on the shared secret. Basically, the first part of the key agreement procedure can be considered as a bootstrapping of a subsequent key exchange. An example of such a key exchange procedure is the Diffie-Hellman key exchange procedure, which is well known in the art of encryption.

  In the example of FIG. 6, each computing subsystem CS1, CS2 extracts the start key from the storage area. In a step referred to as ENC_SECRET1_STEP, the computing subsystem CS1 of the first mobile device MD1 is encrypted with the start key and generates a secret, ie a message containing secret 1. The message is forwarded to the mobile subsystem MS1. The mobile subsystem MS1 then forwards the message to the second mobile device MD2. Here, the mobile subsystem MS2 forwards the message to the computing subsystem CS2. In a step referred to as DEC_SECRET1_STEP, the computing subsystem CS2 uses the start key to decrypt the message. In a step called ENC_SECRET2_STEP, the computing subsystem CS2 generates a message encrypted with the start key using another secret, ie secret 2. Further, in a step called CALC_SK_STEP, the session key SK is calculated based on the secret, ie, a combination of both secret 1 and secret 2, and is included in the message. The message is sent back to the first mobile device 1 by the second mobile device MD2. Here, the mobile subsystem MS1 forwards the message to the computing subsystem CS1. In a step called DEC_SECRET2_STEP, the computing subsystem CS1 uses the start key to decrypt the message. In a step called CALC_SK_STEP, the session key SK is calculated based on the combination of both of the two secrets. As a result, in each computing subsystem CS1, CS2, both secrets, that is, secret 1 and secret 2, can be used. That is, it allows the same session key SK to be calculated by each computing subsystem.

It should be noted that instead of the example of FIG. 6, various alternative mechanisms can be used as well to obtain a shared secret. For example, one of the point-to-point key establishment mechanisms described in the ISO / IEC 1170-2 standard can be used. For example, the key establishment mechanism 5 described in Section 6.5 may be used.
As a result of the subsequent key exchange procedure, a session key is obtained at each mobile device MD1, MD2. This allows a D2D communication session to be established over the D2D communication channel based on the session key.

  The second detailed embodiment includes preloading a so-called master key to each mobile device MD1, MD2. Here, the term master key relates to the start key and, in combination with the usage count, allows a D2D session to be established with one start key. The start key and usage count constitute an alternative to preloading a plurality of start keys that can only be used once when establishing a D2D communication session. Note that the start key can constitute a master key, and each time a start key is needed to establish a particular D2D communication session, a temporary start key is derived from the master key for that purpose. The Thus, the start key can be used multiple times and establishes a temporary start key for use in a particular D2D communication session. The mobile network MN can provide such a start key to the computing subsystems CS1, CS2 in each mobile device MD1, MD2. The start key is valid for a specific validity period. Furthermore, the mobile network MN can provide or set a usage count. The usage count can present, for example, a number of times and allows the computing subsystem to generate a session key using the start key. The mobile network MN can also periodically provide the current network time so that the computing subsystems CS1, CS2 have already expired due to the current network time. Allows you to dispose of any starting key stored in the system. In addition or alternatively, the mobile network MN can provide the current network time when preloading the start key to the mobile devices MD1, MD2.

  After possibly verifying the virtual network identity match, the verification of the start key is verified based on the current time and usage count. If the start key is considered valid, the start key is used in performing a key agreement procedure between mobile devices over the D2D communication channel. In the example 166 shown in FIG. 7, a key agreement procedure is shown. This procedure is based on, for example, a three-pass authentication procedure defined in the ISO / IEC 9798-4 standard.

  First, each computing subsystem CS1, CS2 provides an identifier, i.e. ID1, ID2, to each mobile subsystem MS1, MS2. Each identifier ID1, ID2 identifies each mobile device MD1, MD2. The identification may be indirect in that each identifier ID1, ID2 identifies each computing subsystem CS1, CS2 and then allows the mobile devices MD1, MD2 to identify. This is because the computing subsystems CS1 and CS2 are integrated or removable parts in the mobile device.

  The further steps shown in FIG. 7 will now be described. Here, the reference numerals correspond to those in FIG.

  1. The first mobile device MD1, in this example, is the mobile device that initiates the key agreement procedure and provides the computing subsystem CS1 with a key identifier KeyID that identifies a valid start key at the current time. Request. Whether the computing subsystem CS1 includes such a start key in a step referred to as SELECT_KEYID_STEP, and if so, is still allowed to use the start key, eg Check if the usage count is still below a given threshold if it corresponds to the number of uses, or if the usage count is still greater than zero if the usage count corresponds to the remaining number of uses Judging by doing. In this case, the start key is considered valid and the computing subsystem CS1 establishes a key identifier KeyID that identifies the start key. Furthermore, the computing subsystem CS1 generates a random number RND1 that constitutes a challenge at the time of authentication in the computing subsystem CS2 of the second device MD2.

  2. The computing subsystem CS1 provides the key identifier KeyID and the random number RND1 to the mobile subsystem MS1 of the first mobile device 1.

  3. The first mobile device MD1 sends the key identifier KeyID, the random number RND1 and the identifier ID1 to the second mobile device MD2 through the D2D communication channel DDC to initialize the key agreement procedure.

4). In response, the second mobile device MD2 requests its computing subsystem CS2 to initiate a key agreement procedure. To that end, the second mobile device MD2 provides the key identifier KeyID, the random number RND1 and the identifier ID1 to the computing subsystem CS2. In addition, the computing subsystem CS2 requests the second mobile device MD2 to provide the current time, so that the computing subsystem CS2 has the starting key identified by the key identifier KeyID currently It is possible to verify whether it is valid in the time. This constitutes an additional verification step immediately after receipt of the end of the key agreement procedure, i.e. without initializing it. When the start key identified by the key identifier KeyID is available to the computing subsystem CS2, and is still allowed to use the start key, for example, so that the use count is still greater than zero, the computer Ingu subsystem CS2 at step called CALC_RESP1_STEP, generates a random number RND2 and session key SK _a for authentication. The computing subsystem CS2 further calculates a response to the challenge from the first mobile device MD1, such as E_SK _A (X) with X = RND1 || RND2 || ID2. Here, E_SK _A represents an encryption function using SK _A as a session key and X as a message. An example of such a function is a message authentication code (MAC).

5. The computing subsystem CS2 provides E_SK _A (X) and the random number RND2 to the mobile subsystem MS2 of the second mobile device MD2.

6). The second mobile device MD2 sends E_SK _A (X), the random number RND2, and the identifier ID2 to the first mobile device MD1, and constitutes a response to step 3.

  7). The first mobile device MD1 requests the computing subsystem CS1 to authenticate the response received from the second mobile device MD2 and to generate a response to the challenge provided in the form of the random number RND2. .

8). In a step referred to as CALC_RESP2_STEP, the computing subsystem CS1 creates a session for SK _A authentication and examines the response E_SK _A (X) from the second mobile device MD2. The computing subsystem CS1 then calculates a response to the challenge from the second mobile device MD2, such as E_SK _A (Y) with Y = RND1 || RND2 || ID2. Computing subsystem CS1 generates a session key for use in D2D communication session SK _C. Also, optionally, to generate a session key for secure SK _I. The computing subsystem CS1 then adjusts, eg, decreases, the start key usage count. Finally, the computing subsystem CS1 provides E_SK _A (Y), session key SK _C and optionally SK _I to the mobile subsystem MS1.

9. The first mobile device MD1 sends a response to the challenge from the second mobile device MD2 to the second mobile device MD2 in the form of E_SK _A (Y).

10. In response, the mobile device MD2 requests its computing subsystem CS2 to examine, eg authenticate, E_SK _A (Y).

11. The computing subsystem CS2 then determines in a step called CALC_SESSIONKEY_STEP whether E_SK _A (Y) is valid, in which case it generates a session key SK _C and optionally SK _I , Provide to system MS2. The computing subsystem CS2 then adjusts, eg, decreases, the start key.

12 Mobile subsystem MS2 of the second mobile device MD2 establishes the D2D communication session with the mobile subsystem MS1 of the first mobile device MD1 using the session key SK _C. Therefore, a secure D2D communication session is acquired.

  FIG. 8 shows an alternative 168 of the key agreement procedure 166 shown in FIG. The difference here relates to the fact that identifiers ID1 and ID2 are encrypted during exchange, whereas in the key agreement procedure of FIG. 7, identifiers ID1 and ID2 are exchanged without encryption. Encrypting identifiers ID1 and ID2 during the exchange can prevent the user from being tracked and / or identified by eavesdropping on message exchanges between mobile devices MD1, MD2.

  The further steps shown in FIG. 8 will now be described. Here, the reference numerals correspond to those shown in FIG.

  1. Step 1 corresponds to step 1 described with reference to FIG. 7, with the addition that the computing subsystem CS1 generates a challenge. A challenge is basically a message encrypted using a start key, which is represented by E_MK, and the encrypted message includes a random number RND1 and an identifier ID1.

  2. The computing subsystem CS1 provides the key identifier KeyID and the challenge to the mobile subsystem MS1 of the first mobile device MD1.

  3. The first mobile device MD1 sends a key identifier KeyID and a challenge to the second mobile device MD2 through the D2D communication channel DDC to initialize the key agreement procedure.

  4). In response, the second mobile device MD2 requests its computing subsystem CS2 to initiate a key agreement procedure. To that end, the second mobile device MD2 provides the key identifier KeyID and the challenge to the computing subsystem CS2. In addition, the computing subsystem CS2 requests the second mobile device MD2 to provide the current time, so that the starting key identified by the key identifier KeyID by the computing subsystem CS2 is currently It is possible to verify whether it is valid at any time. This constitutes an additional verification step immediately after receiving the end of the key agreement procedure, i.e. without initializing it. When the start key identified by the key identifier KeyID is available to the computing subsystem CS2, and the use of the start key is still allowed, eg, the use count is still greater than zero, the computing The ing subsystem CS2 generates a random number RND2 and a session key SKA for authentication in a step called CALC_RESP1_STEP. The computing subsystem CS2 further calculates a response to the challenge from the first mobile device MD1, such as E_SKA (X) withX = RND1 || RND2 || ID2. Here, E_SKA represents an encryption function using SKA as a session key and X as a message. An example of such a function is a message authentication code (MAC). The computing subsystem CS2 also calculates a challenge E_MK (RND2 || ID2), which uses the same E_MK as the computing subsystem CS1 of the first mobile device MD1 used in the challenge Is done.

  5. The computing subsystem CS2 provides E_SKA (X) and a challenge to the mobile subsystem MS2 of the second mobile device MD2.

  6). The second mobile device MD2 sends E_SKA (X) and a challenge to the first mobile device MD1, and composes a response to step 3.

  7). The first mobile device MD1 authenticates the response received from the second mobile device MD2, and generates a response to the challenge provided in the form of E_MK (RND2 || ID2). Request to system CS1.

  8-12. Step 8-12 corresponds to Step 8-12 described with reference to FIG.

  Note that, in general, the mobile device's computing subsystem may be mobile if i) no start key is considered valid, or ii) the key agreement procedure fails to provide the session key. Note that it requires an additional start key via the network (MN).

  The present invention can advantageously be applied to direct LTE, ie LTE-based D2D communication between mobile devices. In particular, the present invention enables the following advantageous uses:

  Corporation X purchases a mode subscription directly from operator Y for all its employees. As a result, for example, once a week during the night or during low network loads, all mobile devices of the corporation, such as mobile phones and dongles, will have a set of 100 devices that are active daily in the following week. A start key is provided. The next Monday, some employees want to hold a meeting and share the presentation. However, they are in a meeting room that is outside the network coverage, i.e. outside the mobile network range. They plug the dongle into their laptop and set up a hook network based on Direct LTE. Since all dongles were provided with the same set of initiation keys, employees can set up an LTE-based D2D communication session for the meeting room without having to access the mobile network.

  Another advantageous use is as follows. Again, corporation X purchases a direct mode subscription. Again, for example, once a week during the night or during low network load, all mobile devices of the corporation are provided with a set of 100 start keys that are valid every day in the next week. However, one dongle is switched off during the preload procedure. The next Monday, some employees want to hold a meeting and share the presentation. They are in a room with network coverage. They plug the dongle into their laptop and set up a hook network based on Direct LTE. Since most of the dongles were provided with the same set of initiation keys, the employee office can set up an LTE-based D2D communication session in the meeting room without having to access the mobile network. However, dongles that are switched off during the preload procedure can still participate in the D2 communication session by requesting a set of start keys from one mobile network. Once the set is provided, the dongle participates in the D2D communication session.

  Another advantageous use is as follows and is identical to the above use except that the employee is in a room with network coverage. They plug the dongle into their laptop and set up a hook network based on Direct LTE. Some dongles already have keys that can be used for D2D communication sessions, but only some have expired keys. This is because, for example, D2D communication has not been used for some time, and therefore there is no start key needed to preload or update. Every dongle is now requested a set of start keys from the mobile network, and once the set is provided, each dongle participates in a D2D communication session. On subsequent days, the employee meets again. Now, a D2D communication session can be established immediately, ie without having to contact the mobile network. This is because the dongle already has a set of valid start keys.

  Yet another advantageous use is as follows. For emergency services, it is important to be able to communicate at all times. Thus, mobile devices that rely on network coverage to establish a D2D communication session may not be desirable. This is avoided by preloading the frequency of the start key, for example, every time the mobile device is switched on and / or by preloading the start key associated with a relatively long lifetime. be able to. Preloading may also occur every night when all mobile devices are in their current location. Throughout the day, firefighters, police officers, and emergency personnel can select direct mode of operation when network reception is insufficient. This still allows communication between the emergency service personnel.

  It should be noted that the embodiments described above are described without limiting the present invention and that many alternative embodiments can be designed by those skilled in the art. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The use of the verb “comprise” and its conjugations does not exclude the presence of elements or steps other than those stated in the claims. The “a” “an” preceding a component does not exclude the presence of a plurality of such components. The present invention can be implemented by hardware means comprising several separate components and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means can be embodied by one piece of hardware and the same item thereof. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims (15)

A method (100) for a mobile device (MD1, MD2) to establish a device-to-device (D2D) communication session with another mobile device (MD2, MD1), the mobile device (MD1) , MD2) can be connected to the other mobile device (MD2, MD1) via a D2D communication channel (DDC), and the mobile device (MD1, MD2) can be connected to a mobile network (MN). Yes, in the mobile devices (MD1, MD2)
-Preloading the mobile device (MD1, MD2) with a start key (120), wherein the start key is associated with a validity period;
-Verifying the validity of the start key based on the validity period (140);
-When executing the key agreement procedure (164, 166) with the other mobile device (MD2, MD1) through the D2D communication channel (DDC) if the start key is considered valid; Generating a session key by using a start key (160) if the result of the key agreement procedure is that the start key matches another start key used by the other mobile device; The session key, and
-Establishing (180) the D2D communication session through the D2D communication channel (DDC) based on the session key;
Including a method.   The method (100) of claim 1, wherein the step of preloading the start key (120) via the mobile network when the mobile device is connected to the mobile network (MN). Providing the start key to the mobile device (MD1, MD2). 3. The method (100) according to claim 1 or 2, wherein preloading the start key (120) stores the start key in a secure storage area (SA1) of the mobile device (MD1, MD2). Including steps,
Optionally, the secure storage area (SA1) is provided by a reliable computing subsystem (CS1, CS2) in the mobile device (MD1, MD2).   4. The method (100) of claim 3, wherein at least one of the group consisting of verifying the validity of the start key (140) and using the start key in performing the key agreement procedure: The method performed by the trusted computing subsystem (CS1, CS2). The method (100) according to any one of claims 1 to 4, further comprising:
-Preloading a set of start keys to the mobile device (MD1, MD2), wherein the set of start keys is associated with each of a set of validity periods;
A key synchronization procedure with the other mobile device (MD2, MD1) through the D2D communication channel (DDC) to select a matching one of the set of start keys as the start key; Executing step (162);
Including a method. The method (100) of claim 5, further comprising:
Preloading (120) a set of key identifiers at the mobile device (MD1, MD2), each of the set of key identifiers identifying a respective one of the set of start keys; Steps,
Performing the key synchronization procedure based on exchange with one or more of the other mobile devices of the set of key identifiers (162);
Including a method.   The method (100) of claim 5 or 6, further comprising the step of disabling or deleting the start key from the set of start keys after use in establishing the D2D communication session. Method.   The method (100) according to any one of claims 5 to 7, wherein the set of validity periods is at least partly constituted by different but overlapping validity periods.   9. The method (100) according to any one of claims 1 to 8, wherein the starting key is associated with a virtual network identity and verifying the validity of the starting key (140) further comprises the D2D communication. Determining a match of the virtual network identity of the mobile device (MD1, MD2) with a virtual network identity of the other mobile device (MD2, MD1) via a channel (DDC) (142) ). 10. The method (100) according to any one of claims 1 to 9, wherein the start key is associated with a use count for limiting the number of uses of the start key, and the validity of the start key is verified. And (140) further based on the usage count,
The method further includes the step of optionally adjusting the usage count after using the start key in establishing the D2D communication session. The method (100) according to any one of claims 1 to 10, further comprising:
i) no start key is considered valid, or ii) if the key agreement procedure fails to provide the session key, request another start key via the mobile network (MN) A method comprising the steps of: 12. A method as claimed in any preceding claim, wherein the key agreement procedure comprises:
-A three-pass authentication procedure (166), or-use of an initiation key (164) to encrypt a message exchange between the mobile device and the another mobile device to obtain a shared secret; And a Diffie-Hellman key exchange procedure initiated based on the shared secret,
Including a method.   Control software, when the control software is executed on a mobile device (MD1, MD2), the D2D communication session is transmitted to the mobile device according to the method of any one of claims 1-12. Control software, including instructions for establishing. A mobile device (MD1) that establishes a device-to-device (D2D) communication session with another mobile device (MD2), and the mobile device communicates with the other via a D2D communication channel (DDC) Can be connected to any mobile device, the mobile device can be connected to a mobile network (MN), and the mobile device
A storage area (SA1) for storing a start key provided during the preload procedure, wherein the start key is associated with a validity period;
A computing subsystem (CS1),
-Verifying the validity of the start key based on the validity period;
-If no valid key is considered valid, request another start key via the mobile network (MN);
A session by using the start key when performing a key agreement procedure with the other mobile device (MD2) through the D2D communication channel (DDC) when the start key is considered valid; Generating a key, and as a result of the key agreement procedure, if the start key used by the mobile device and the other mobile device matches, it is used as the session key;
A computing subsystem;
A mobile subsystem (MS1) for establishing the D2D communication session through the D2D communication channel based on the session key;
A mobile device comprising:   15. A mobile network (MN) configured to preload a start key to a mobile device (MD1) according to claim 14, wherein the start key is connected to the mobile network. A mobile network that is associated with a lifetime.

Images